Anyone have interest in FortiWeb communicating malicious traffic sources to FortiGate?

[ispcolohost]

I've recently deployed an HA pair of FortiGate's and FortiWeb's to protect a web app.  I configured the "FortiGate Integration" option on the FortiWeb side, but was disappointed to find that this only communicates quarantined source IP's to the FortiWeb from the FortiGate.

This seems illogical to me given the fact that the FortiGate is capable of processing, and possibly dropping, traffic at a far greater rate than FortiWeb devices, so what is the point of even having such integration; just make the FortiGate drop them.  The only reason I can see such a feature existing is for those using the FortiWeb as an outbound proxy, rather than inbound.

The feature I had hoped to see was for the FortiWeb to be able to inform a FortiGate about bad activity and the FortiGate drop those sources for some defined period of time.  The FortiWeb has the ability to perform very detailed layer 7 http/https inspection for malicious activity, along with hardware-assisted SSL, but has an order of magnitude less traffic handling than similarly priced FortiGate models.

For example, the FortiWeb 400D, which is not what I'd call inexpensive at $10k+, can only handle 100 Mbps of throughput.  Similarly priced FortiGate 600D can handle 24-36 Gbit/sec.  If some bad actor who is not on a 'known bad' IP address has a few hundred megabits of bandwidth available, he could just send 200 Mbit of SQL injection HTTPS requests to the web app, FortiGate will happily pass them through all day long while the FortiWeb gets taken down.

Seems completely obvious to me that there should be a feature where FortiWeb says hey, IP 192.0.2.1 has sent <configurable number> of malicious requests, let's tell the FortiGate to drop packets from that source for <configurable number of minutes>.  Now you have the 24+ Gbit/sec device mitigating an attack to protect the 100 Mbit/sec device.  Anything short of that means to have your web app survive an application attack, particularly if it's distributed, would be to put a $150k FortiWeb model in place behind your $10k firewall.  Or, go with a service instead of Fortinet products at all, like Cloudflare.  For a couple hundred/month, Cloudflare seems like the way to ago.

I raised these concerns to my sales rep and SE, it made it to FortiWeb product management, the response was no one's ever asked for that so there's no demand and we don't see any reason to do that.  I'm guessing this means most users of FortiWeb's are using them as outbound appliances to protect internal users, and not my use case which is protect web apps on the inside from layer 7 attacks?